Forminator Forms Contact Form Payment Form Custom Form Builder
Monthly
Unauthenticated attackers can delete other users' saved drafts and seize their draft identifiers by abusing the 'previous_draft_id' parameter in the Forminator Forms WordPress plugin through version 1.57.3.1, letting them overwrite a victim's draft with attacker-controlled submission content. The nonce that nominally guards the request provides no barrier because any visitor can obtain it by loading a public form page; the real limiting factor is that the attacker must already know the victim's draft_id, which the advisory says may be harvested from a shared 'continue later' resume link, so this is not blind or arbitrary exploitation against every installation. No CISA KEV entry or confirmed public exploit code is available at time of analysis, though the issue is prioritized this_week and affects integrity only, with no confidentiality or availability impact under the assessed vector.
Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin).
Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Path Traversal in Forminator Forms plugin allows unauthenticated remote attackers to read arbitrary files from WordPress servers, potentially exposing database credentials, configuration files, and sensitive user data. Exploitation requires a publicly accessible form with File Upload field and specific 'Save and Continue' behavior settings enabled. CVSS 7.5 (High) with network vector and no authentication required. No CISA KEV listing or public exploit identified at time of analysis, suggesting limited active exploitation despite high theoretical severity.
Unauthenticated deletion of arbitrary non-PHP files inside wp-content/uploads/ affects every version of the Forminator Forms WordPress plugin up to and including 1.55.0.2. The plugin trusts upload field metadata supplied in POST requests for draft submissions, and when a later draft is linked to the poisoned one through the previous_draft_id parameter, that attacker-controlled metadata is used as the file path for a delete operation. No KEV entry, no EPSS signal and no public exploit code were identified at time of analysis; exploitation is limited to media and attachments rather than code execution, since PHP files and paths outside the uploads directory are out of scope, keeping this a moderate-priority issue slated for this-month handling rather than emergency response.
Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.
Missing authorization in Forminator Forms for WordPress (versions up to 1.51.1) allows authenticated users with subscriber-level access or restricted Forminator roles to perform sensitive module-management actions including export, delete, clone, and bulk status changes by bypassing capability checks. The vulnerability exists because the `processRequest()` method validates only a nonce without verifying the `manage_forminator_modules` capability, and fires during the `admin_menu` hook before WordPress enforces page-level permission checks. This enables attackers to export complete form configurations including credentials and conditional logic, delete submissions, or manipulate published modules.
Forminator plugin for WordPress versions up to 1.52.0 allows unauthenticated attackers to bypass payment authorization by reusing previously succeeded Stripe PaymentIntent identifiers, enabling submission of high-value paid forms at no cost or reduced cost through payment bypass. The vulnerability affects the public payment processing flow where the plugin fails to verify that the attacker owns or is authorized to use a supplied PaymentIntent, making it possible to complete forms without proper payment validation.
Unauthenticated attackers can delete other users' saved drafts and seize their draft identifiers by abusing the 'previous_draft_id' parameter in the Forminator Forms WordPress plugin through version 1.57.3.1, letting them overwrite a victim's draft with attacker-controlled submission content. The nonce that nominally guards the request provides no barrier because any visitor can obtain it by loading a public form page; the real limiting factor is that the attacker must already know the victim's draft_id, which the advisory says may be harvested from a shared 'continue later' resume link, so this is not blind or arbitrary exploitation against every installation. No CISA KEV entry or confirmed public exploit code is available at time of analysis, though the issue is prioritized this_week and affects integrity only, with no confidentiality or availability impact under the assessed vector.
Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin).
Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Path Traversal in Forminator Forms plugin allows unauthenticated remote attackers to read arbitrary files from WordPress servers, potentially exposing database credentials, configuration files, and sensitive user data. Exploitation requires a publicly accessible form with File Upload field and specific 'Save and Continue' behavior settings enabled. CVSS 7.5 (High) with network vector and no authentication required. No CISA KEV listing or public exploit identified at time of analysis, suggesting limited active exploitation despite high theoretical severity.
Unauthenticated deletion of arbitrary non-PHP files inside wp-content/uploads/ affects every version of the Forminator Forms WordPress plugin up to and including 1.55.0.2. The plugin trusts upload field metadata supplied in POST requests for draft submissions, and when a later draft is linked to the poisoned one through the previous_draft_id parameter, that attacker-controlled metadata is used as the file path for a delete operation. No KEV entry, no EPSS signal and no public exploit code were identified at time of analysis; exploitation is limited to media and attachments rather than code execution, since PHP files and paths outside the uploads directory are out of scope, keeping this a moderate-priority issue slated for this-month handling rather than emergency response.
Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.
Missing authorization in Forminator Forms for WordPress (versions up to 1.51.1) allows authenticated users with subscriber-level access or restricted Forminator roles to perform sensitive module-management actions including export, delete, clone, and bulk status changes by bypassing capability checks. The vulnerability exists because the `processRequest()` method validates only a nonce without verifying the `manage_forminator_modules` capability, and fires during the `admin_menu` hook before WordPress enforces page-level permission checks. This enables attackers to export complete form configurations including credentials and conditional logic, delete submissions, or manipulate published modules.
Forminator plugin for WordPress versions up to 1.52.0 allows unauthenticated attackers to bypass payment authorization by reusing previously succeeded Stripe PaymentIntent identifiers, enabling submission of high-value paid forms at no cost or reduced cost through payment bypass. The vulnerability affects the public payment processing flow where the plugin fails to verify that the attacker owns or is authorized to use a supplied PaymentIntent, making it possible to complete forms without proper payment validation.